We'll end up learning our lesson if the major pools get DDoSed one day, simultaneously. The way things have been escalating, I wouldn't be too surprised if this happened.
That's only a problem if there are no smaller independent pools and individual miners left and
a concerted attack is mounted in the form of a large attacking pool trying to subvert the blockchain, but this means a lot of investment and once the big pools return they might have done some work that will invalidate the bogus links in the chain anyway. In fact, if it comes down to a catastrophic event once they are back the big pools could decide to cooperate on fixing the blockchain (sort of like a Mt. Gox rollback
The average botnet operator will gain more by simply participating (have their own pool if other big pools reject them).